JWT Decoder
Processed in your browserDecode JWT header and payload locally. Inspect claims—signature is not verified.
What this tool does
Decode JWT header and payload locally. Inspect claims—signature is not verified.
Features
- Header decode
- Payload decode
- Copy JSON
How to decode a JWT
- Paste a JWT (three Base64URL segments separated by dots).
- Click Decode JWT to view header and payload JSON.
- Copy the result for debugging—do not trust claims without signature verification.
Example: decode the payload
- Input
- eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.…
- Result
- Header {"alg":"HS256","typ":"JWT"} Payload {"sub":"1234567890","name":"John Doe","iat":1516239022}
Common uses
- Inspect claims like sub, exp, and roles while debugging auth.
- Check when an access token expires.
- Confirm which algorithm a token uses.
Supported formats
- JWT text
Limits
- Decode only—no HMAC or RSA verification
Limitations
- Never use decoded tokens for authorization decisions on a server.
Privacy
Tokens are parsed locally; nothing is sent to Toolstik.
Frequently asked questions
Related guides
- How to Convert a Unix Timestamp to a Date (and Back)
How to convert a Unix timestamp to a readable date and back: seconds vs milliseconds, time zones, the 2038 problem, and copy-ready code for JS, Python, SQL, and bash.
- Free Developer Tools Online: JSON, JWT, Base64, URL, Timestamp & Regex
Free developer tools online that run in your browser: format JSON, decode JWTs, encode Base64 and URLs, convert Unix timestamps, and test JavaScript regex.
- How to Decode a JWT Safely
How to decode a JWT safely: inspect the header and payload locally in your browser, read exp and iat, and avoid the mistake of trusting unverified claims.
- JSON Pretty Print vs Minify — What's the Difference?
JSON pretty print vs minify: what each does, how much size you actually save, how gzip changes the math, and when to use each format in your workflow.
- JWT Header vs Payload vs Signature Explained
JWT header vs payload vs signature explained: what each segment contains, how Base64URL encoding and signing work, and why only the signature makes a token trustworthy.
- How to Format and Validate JSON Online
Format and validate JSON online in your browser: paste, click Format, Minify, or Validate, and get line and column hints for syntax errors. No upload.
You may also need
JSON Formatter & Validator
Format, validate, and minify JSON. Tree view with syntax error highlighting.
Unix Timestamp Converter
Convert Unix timestamps to readable dates and dates back to epoch seconds or milliseconds.
Base64 Encoder / Decoder
Encode or decode text to Base64 with optional URL-safe output—all in your browser.
URL Encoder / Decoder
Encode or decode URLs and query components with encodeURI or encodeURIComponent.
Browse the free developer toolkit for every related tool and guide.